CVE-2026-33643

HighPublic PoC

Published: 30 March 2026

Published

30 March 2026

Modified

02 April 2026

KEV Added

—

Patch

—

CVSS Score v3.1 7.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L

EPSS Score 0.0005 14.6th percentile

Risk Priority 15 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2026-33643 is a high-severity SQL Injection (CWE-89) vulnerability in Schemahero Schemahero. Its CVSS base score is 7.4 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 14.6th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).

Deeper analysis

CVE-2026-33643, published on 2026-03-30, is a SQL injection vulnerability (CWE-89) in SchemaHero version 0.23.0. The issue arises via the column parameter passed to the mysqlColumnAsInsert function in the file plugins/mysql/lib/column.go. It has a CVSS v3.1 base score of 7.4 (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L), indicating network accessibility, low attack complexity, low privileges required, no user interaction, changed scope, and low impacts across confidentiality, integrity, and availability.

An attacker with low privileges can exploit this vulnerability remotely without user interaction. Successful exploitation enables SQL injection, potentially allowing limited access to data (C:L), modification of database contents (I:L), and disruption of service (A:L), with effects propagating beyond the vulnerable component due to the changed scope (S:C).

Advisories and proof-of-concept details are available at https://gist.github.com/b0b0haha/fb59199fb1fdf9414e76442e0599bfed and https://github.com/b0b0haha/SchemaHero--Sqlinjection/blob/main/README.md, which security practitioners should review for exploitation demonstrations and any recommended mitigations or patches.

EU & UK References

🇪🇺 ENISA EUVD: EUVD-2026-17137

Vulnerability details

SQL Injection vulnerability in SchemaHero 0.23.0 via the column parameter to the mysqlColumnAsInsert function in file plugins/mysql/lib/column.go.

CWE(s): CWE-89

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

attack.mitre.org →

Why these techniques?

Remote network-accessible SQL injection (AV:N, PR:L) in SchemaHero directly enables exploitation of a vulnerable application for initial access or limited data/modification impacts.

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1